CVE-2025-11849

We need to produce a JSON object for CVE-2025-11849.

First, parse the input data:

CVE ID: CVE-2025-11849 Description: Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero. CVSS Score: 5.4 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-22

EPSS: 0.23% (percentile 46%) Patch: Available from vendor Tags: Path Traversal References: multiple snyk and GitHub gist, commit.

So product is "mammoth". It's a docx to HTML converter library. Versions <1.11.0 are affected. The fix is in commit that disables external file access by default. Patch available (from vendor, meaning version 1.11.0).

Now follow instructions strictly.

product_name: "mammoth" (1-3 words, specific product: mammoth)

summary: Must be original synthesis, not copy description. Start with impact verb. Example: "Directory traversal in mammoth library before 1.11.0 allows ..." Since it's directory traversal leading to arbitrary file read and resource consumption. Mention actively exploited? Not in KEV, no active exploitation mentioned. POC? There's a Gist, but that's a security advisory, not necessarily a public exploit